-
Notifications
You must be signed in to change notification settings - Fork 284
[FEATURE]: Use Internal k8sUtil Image #6877
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
@msharma38 thanks for reporting this! Ability to use a custom registry mirror for utility images was implemented in #6552. Please check the guide at https://docs.garden.io/kubernetes-plugins/guides/registry-mirror We hope that helps. Please let use know if you have any troubles with that approach. |
@msharma38 I'm going to close this issue. Feel free to reopen it if the issue persists. |
HI @vvagaytsev after we have imported the image inside our GAR and attesting it the digest is different for what it is present in docker hub as we are referring the digest from docker hub in image which is not present in my internal repo the build is failing with below error Kubernetes Message: admission webhook "mutate.kyverno.svc-fail" denied the request: mutation policy resolve-image-to-digest error: failed to apply policy resolve-image-to-digest rules [autogen-resolve-to-digest: failed to mutate elements: variable substitution failed: failed to resolve resolvedRef at path /patchStrategicMerge/spec/template/spec/containers/0/image: failed to fetch image descriptor: us-docker.pkg.dev/wf-gcp-us-plat-gar-prod/external-staging/gardendev/k8s-util:0.6.4@sha256:0f41babfcfa216fe23561195c5c096aff6d9c374cd8850da12b6e00bc944491b, error: failed to fetch image descriptor: us-docker.pkg.dev/wf-gcp-us-plat-gar-prod/external-staging/gardendev/k8s-util:0.6.4@sha256:0f41babfcfa216fe23561195c5c096aff6d9c374cd8850da12b6e00bc944491b, error: failed to fetch image reference: us-docker.pkg.dev/wf-gcp-us-plat-gar-prod/external-staging/gardendev/k8s-util:0.6.4@sha256:0f41babfcfa216fe23561195c5c096aff6d9c374cd8850da12b6e00bc944491b, error: GET https://us-docker.pkg.dev/v2/wf-gcp-us-plat-gar-prod/external-staging/gardendev/k8s-util/manifests/sha256:0f41babfcfa216fe23561195c5c096aff6d9c374cd8850da12b6e00bc944491b: MANIFEST_UNKNOWN: Requested entity was not found.] |
@msharma38 did you rebuild the image to upload it to GAR? If you copy the image using a tool like regctl ( |
GAR also allows you to set up a pull-through cache (they call that a "remote repo"), is that maybe what you need? |
@stefreak we are running |
HI @stefreak i am trying to update to garden 0.13.54 and getting below error [k8s-buildkite-agent stage-1 9/9] RUN cd /tmp/garden_init && git init && garden util fetch-tools: | 0.349 hint: Using 'master' as the name for the initial branch. This default branch name We are using alpine:3.15.0 as base image this was working with garden 0.13.35 version |
@msharma38 I'm not quite sure what I'm looking at here, this looks like an error output from Docker compose. Can you share the |
@stefreak below is the docker file which is working for 0.13.35 version of garden
|
@stefreak did you checked the above file as we are blocked completely and one more question is there any way we can specify the k8's util image in garden |
@msharma38 I'm sorry this is blocking your team. You can specify the util image registry in Garden (Docs are here). What you're doing isn't supported at the moment in the Open-Source Garden. The latest versions of Garden pin the SHA256 of each Docker image it ships with to prevent inadvertently using wrong or modified images. I didn't fully comprehend your needs yet, but it seems like a feature request to me, as you seem to have special requirements on the provenance of the Garden Docker images, and the requirement that the attestations are signed. We do accept contributions, so you you're happy to implement what you need and contribute. We also offer Enterprise support plans (Contact us at https://garden.io/contact) where we also do solution engineering. Here on GitHub on the other hand we're providing best-effort support to the community and small-scale users. |
@stefreak did you get the chance to look into the docker file for the error |
Yes, as I've said the latest versions of Garden pin the SHA256 of each Docker image it ships with to prevent inadvertently using wrong or modified images. This is what is causing the error. |
The easiest solution that I can see is using the artifact registry "remote repo" feature, as it will preserve the SHA256 of the images. https://cloud.google.com/artifact-registry/docs/repositories/remote-repo |
@stefreak we are updating garden version from 0.13.35 to 0.13.54 but while doing that we are getting the below error Error :- | 1.576 Error relocating /home/buildkite/.local/share/garden/1741680672-wSzfzLh.r/bin/node: _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE15_M_replace_coldEPcmPKcmm: symbol not found Docker file :- ARG BK_HTTP_PROXY FROM alpine:3.15.0 as builder FROM external-staging/buildkite/agent:3.49.0 LABEL COPY --from=builder /usr/bin/gh /usr/bin/ RUN echo "Starting build" Install gcloud SDK&& apk add --no-cache curl bash python3 Install beta components&& /usr/local/google-cloud-sdk/bin/gcloud components install beta --quiet #Install garden Installl goRUN curl -O https://dl.google.com/go/go1.21.9.linux-amd64.tar.gz RUN apk update && apk add libstdc++6 USER 1001 RUN mkdir -p /tmp/garden_init RUN cd /tmp/garden_init Wanted to ask if we are using any particular version of node which may be causing this error? Can you help use herer |
@stefreak I have updated the garden version to 0.13.54 but when i am running garden deploy command from buildkite getting below error Error:- Error: unable to connect to beta: unable to connect to endpoint: unable to dial agent endpoint: version handshake error: version mismatch Here's the full output: Creating session... |
Feature Request
We want to reference k8sUtil image rom out internal registry not from docker hub.
What should the user be able to do?
Reference k8sUtil image rom out internal registry i.e GAR or artifactory
Why do they want to do this? What problem does it solve?
We are hitting into below issue where garden is trying to pull the image from open source docker hub and getting below issue.
failed to resolve resolvedRef at path /patchStrategicMerge/spec/template/spec/containers/0/image: failed to fetch image descriptor: gardendev/k8s-util:0.5.7@sha256:522da245a5e6ae7c711aa94f84fc83f82a8fdffbf6d8bc48f4d80fee0e0e631b, error: failed to fetch image descriptor: gardendev/k8s-util:0.5.7@sha256:522da245a5e6ae7c711aa94f84fc83f82a8fdffbf6d8bc48f4d80fee0e0e631b, error: failed to fetch image reference: gardendev/k8s-util:0.5.7@sha256:522da245a5e6ae7c711aa94f84fc83f82a8fdffbf6d8bc48f4d80fee0e0e631b, error: GET https://index.docker.io/v2/gardendev/k8s-util/manifests/sha256:522da245a5e6ae7c711aa94f84fc83f82a8fdffbf6d8bc48f4d80fee0e0e631b: TOOMANYREQUESTS: You have reached your unauthenticated pull rate limit. https://www.docker.com/increase-rate-limit]
Suggested Implementation(s)
give an option for users to use pass k8sUtil image path.
How important is this feature for you/your team?
🥀 Crucial, Garden is unusable for us without it
The text was updated successfully, but these errors were encountered: